Privacy Notice – Client and Third Party

Effective date: July 2018

Contents

1. Who we are
2. Who does this privacy notice apply to?
3. What information is covered?
4. The information we collect and how we use it
5. International transfers
6. Disclosures
7. Service providers
8. Keeping your information up to date
9. Retention
10. Your rights

1. WHO WE ARE

Antalis (“ANTALIS”) is a French Société Anonyme with a share capital of 213 000 000 euros, registered with the Registre du Commerce et des Sociétés of Nanterre under number 410 336 069, and having is registered office at 8 rue de Seine, 92100 Boulogne-Billancourt (France).

ANTALIS Group is the leading professional paper distributor and provider of packaging and Visual Communication solutions in Europe and the world (outside of the United States). ANTALIS Group is the only operator in its sector with an international presence in 41 countries through its affiliated companies. The ANTALIS Group provides one of the most extensive and diversified ranges of products and solutions in the market and offers its clients a high and ground breaking level of service in terms of customization, expertise and logistics, mainly through its 123 distribution centers situated throughout the world.

Contact details for our ANTALIS companies around the world can be found on our website www.antalis.com.

ANTALIS is committed to collecting, maintaining, and using personal information about our clients and business contacts responsibly. The provisions of data protection laws in the European Union and elsewhere impose strict conditions on ANTALIS.

Through its Code of Conduct, ANTALIS has made, for itself and its Group of companies, a statement by which the Group recognizes the fundamental and inalienable right, for each individual, to the protection of his/her private life and his/her personal data. commitment to implement the necessary procedures so that the collection and processing of the personal data that it carries out in the course of its activities, is performed according to the law applicable and with due respect of the individuals, the security and the confidentiality of their information. You can find more on our website www.antalis.com.

ANTALIS Group works to update its processes in accordance to the EU Regulation 2016/679 on the Personal Data Protection by setting up an internal program of data protection to sponsor a consistent standard across ANTALIS Group when collecting, using, and managing personal information.

The data controller(s) in respect of your personal information will be the ANTALIS Company or companies with which you are dealing and/or ANTALIS, which shall be referred to as ANTALIS here below.

This privacy notice explains how we may collect, use and disclose information about clients, suppliers, shareholders and other business and company contacts, and describes the rights you may have in respect of your own personal information. Please read it carefully.

2. WHO DOES THIS PRIVACY NOTICE APPLY TO?

Clients

This notice applies to the individual client contacts with whom we deal, including prospective clients. It applies to personal information that is collected as part of our client on-boarding process and discontract, as well as to the information gathered during the course of a client relationship.
It also applies to the personal information of employees at client entities whose details we may receive as part of the provision of products and services. In these circumstances our main client contact is responsible for ensuring that all affected individuals are made aware that their personal details will be provided to us and of the purposes for which we will use that information, for example by showing them a copy of this notice.

Shareholders

The above description applies the same to our shareholders.

Suppliers

The above description applies the same to our suppliers.

Business Contacts

In addition, this notice covers the personal information of individuals who are not existing or former clients or shareholders but who engage with ANTALIS by signing up to receive communications such as email alerts and publications, or who attend events run by ANTALIS (either alone or in conjunction with partner organizations).

Other Contacts

This notice also covers the personal information of individuals that ANTALIS has a business arrangement or contact with in the course of its business, such as agents, other stakeholders and adverse parties.

3. WHAT INFORMATION IS COVERED?

In this privacy notice, “personal information” means any information (whether electronic or written) relating to an individual who can be identified directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that individual.

It also includes special categories of personal information (“special category data”) from which we can determine or infer an individual’s racial or ethnic origin, political opinions, religious beliefs or other beliefs of a similar nature, membership of a trade union, physical or mental health or condition (including biometric and genetic data), sexual life/orientation, or judicial data (including information concerning the commission or alleged commission of a criminal offence and any sentence or penalty imposed).

ANTALIS will only collect special category data if it is necessary for one of the purposes described below. Further information about when and why we may need to do this is set out in section 4 “The information we collect and how we use it” here below.

4. THE INFORMATION WE COLLECT AND HOW WE USE IT

ANTALIS may use your personal information for a variety of purposes, as outlined in the following sections.

ANTALIS is committed to collecting and using only the personal information that is necessary for the provision of products and services to our clients; to establish and/or maintain its business relationship with business contacts; and to keep individuals informed of products and services and events which it reasonably considers may be of interest to them and/or which they have otherwise confirmed their preference to receive from ANTALIS. You can find more details about the purposes, the information we may collect, the source of the information and the legal authority relied upon by ANTALIS by sending a request to the following dedicated email dpo@antalis.com

In some cases, it will be mandatory for you to provide personal information to ANTALIS to enable us to provide products and services to you (or your employer), engage with you or to comply with ANTALIS’s legal obligations.

Identity, Conflicts, Anti-Money Laundering and other Checks

ANTALIS collects a variety of information about clients and contacts as part of our new contact on boarding process. This may be referred to as due diligence or “Know Your Client” or “Know Your Supplier”. The checks may include some or all of the following:
• Identity verification: proof of name and address
• Ultimate beneficial ownership of corporate and other legal entities
• Conflicts checks: to avoid a conflict of interest
• Anti-money laundering, proceeds of crime and terrorist financing checks
• Politically Exposed Persons checks: those with prominent roles in government, judiciary, courts, central banks, embassies, armed forces and state-owned enterprises, including their family members and close associates
• Government Sanctions List checks
• Insider List

These checks are made for legal, regulatory or business reasons and may need to be repeated during the course of our contract. It is important that you provide us with all necessary information and documents or this may affect our ability to provide products and services.

We may use third party sources to obtain some of this information. Details can be accessed by sending a request to the following dedicated email dpo@antalis.com

Providing Products and Services

ANTALIS may collect or generate additional details about you during the course of our contract, for the purpose of providing products and services.

We may also use your personal information:
• To administer our relationship and maintain contractual relations
• For accounting and tax purposes
• For marketing and business development
• To comply with ANTALIS’s regulatory obligations
• To establish, exercise or defend legal rights
• For the prevention and detection of crime
• For historical and statistical purposes

Other Business Interactions

As part of your business or other commercial dealings with ANTALIS, we may collect or generate details about you. We may use this personal information to administer our relationship and maintain contractual relations, for accounting and tax purposes and to comply with our regulatory obligations.

We may also share your personal data with third parties if we sell or buy a business or assets, in which case we may need to disclose personal data to the prospective seller or buyer of the business or the assets in question, as well as their professional advisers. If the company or substantially all of its assets are acquired by a third party or one company of our Group, the personal data we hold by the seller will be included in the transferred assets.

Information Collected at our Premises

If you visit our premises, your image may be captured on CCTV systems operated by ANTALIS or the entity which manages our premises. Building access control systems may also capture the location, time and date of your entry and exit to our offices.

Communications

Where permitted by applicable law, ANTALIS may record and/or monitor telephone calls made and received and electronic communications sent to or received by ANTALIS’s networks in order to protect our business and verify compliance with our policies and relevant legal requirements. Any such recording and/or monitoring will be carried out for lawful business purposes and in accordance with applicable laws and regulations. This may include the following purposes:
• Recording facts (including converting voice messages into text)
• Establishing compliance with ANTALIS’s policies and procedures
• Complying with applicable laws and regulations
• For crime prevention and detection
• To monitor the effective use and operation of ANTALIS’s networks and systems

In order to communicate efficiently, correspondence and documents may be sent by unencrypted email. You will be aware that this is not guaranteed as a secure method of communication, nor are there any service standards for delivery. If you would prefer us not to use unencrypted email, please speak to your contact at ANTALIS.

Marketing and Business Development

ANTALIS collects information for marketing and business development purposes and as part of the general administration of client relationships. We may use some personal information for client entertainment purposes, including recording your interests and preferences.

We may use your personal details to send you information by email or post, or using social media or social networking sites, about our products and services, developments in industry, brochures, press releases, invitations to seminars and talks. You can select the areas and subjects you are interested in when you sign up on our website. You may update your preferences or opt out at any time. For more information on how to exercise your rights, see section 10 “Your rights below”.

Events

If you attend an event that is run by or in association with ANTALIS, we will collect contact details as part of event registration. This information may include dietary requirements and details of any health issues or disabilities which may impact upon your attendance at or participation in the event. Where an event is run in association with a partner organization or hosted at an external venue, we may need to share your personal details with the partner, event organizer or venue. Only the minimum information will be shared as necessary for the purposes of running the event. If the event is run in association with a partner organization, they will be responsible for informing you about any marketing they may wish to undertake and obtaining your consent where necessary.

Cookies

If you use our websites, we inform you that they use cookies and other web traffic analysis tools (eg, Pixel Tracking, Google Analytics, etc.). Please click on our cookies-use-policy for more information on our use of these tools or request it at dpo@antalis.com

5. INTERNATIONAL TRANSFERS

ANTALIS is an international group operating on a global basis. Like most international businesses, ANTALIS has centralized certain aspects of its client administration and records management in the European Union. In addition, where projects span more than one jurisdiction, information will need to be accessed by all those within ANTALIS who are working on the matter. As a result, your personal information may be transferred outside the country of origin (which includes transfers outside the European Economic Area) and may be accessed across ANTALIS on a global basis.

ANTALIS will take all necessary security and legal precautions to ensure the safety and integrity of personal information that is transferred within ANTALIS to allow for global transfers within ANTALIS of personal information originating in the EEA in accordance with applicable European Privacy Laws through the use of the same standards of protection for personal information. Your personal information will therefore be given the same level of protection regardless of its location within ANTALIS.

Your personal information will also be accessed by ANTALIS’s service providers who may be located in other jurisdictions. For more information, see section 7 Service providers below.

6. DISCLOSURES

ANTALIS may disclose your personal information (i) where this is necessary for the stated purposes, including within ANTALIS itself; (ii) if required by applicable law; (iii) in connection with a reorganization or combination of our firm with another firm, (iv) if we believe that such disclosure is necessary to enforce or apply terms of contract and other agreements or otherwise protect and defend ANTALIS’s rights, property or safety; (v) in order to comply with a judicial proceeding, court order or other legal obligation, or a regulatory or government inquiry; or (vi) with your consent.

We would like to draw particular attention to the fact that in some jurisdictions, ANTALIS has a legal obligation to report suspicious transactions and other activity to relevant regulatory authorities under anti-money laundering, terrorist financing, insider dealing or related legislation. ANTALIS may also report suspected criminal activity to the police and other law enforcement bodies. We may not be permitted to inform you about this in advance of the disclosure, or at all.

Third party recipients of personal information relating to clients, business and firm contacts may include:
• Tax and Customs & Excise authorities
• Regulatory and other professional bodies
• Stock exchange and listing authorities
• Public registries of company directors and shareholdings
• Providers of identity verification services
• Credit reference agencies
• The courts, police and law enforcement agencies
• Government departments and agencies
• Auditors and professional advisers (including professional indemnity insurers and advisers)

ANTALIS will use all reasonable efforts to disclose the minimum personal information necessary in each case.

7. SERVICE PROVIDERS

Third parties providing services to ANTALIS are referred to as “Sub-contractors.” ANTALIS will put in place contracts with Sub-contractors which address the requirements of relevant privacy laws. Sub-contractors will be required to use appropriate security measures to protect personal information and will be prohibited from using personal information other than as instructed by ANTALIS.

Sub-contractors who process personal information on behalf of ANTALIS may be located in Europe or other countries around the world. ANTALIS will ensure that Sub-contractors comply with any applicable legal requirements for transferring personal information outside the jurisdiction in which it was originally collected. For data collected in the European Economic Area or which relates to data subjects in the EEA, ANTALIS will require Sub-contractors to execute the Standard Contractual Clauses for the transfer of personal information to third countries, as sanctioned under applicable European privacy laws.

If you would like more information about the Sub-contractors we work with, please contact the Global Data Protection Officer by sending a request to the following dedicated email dpo@antalis.com

8. KEEPING YOUR INFORMATION UP TO DATE

ANTALIS makes every effort to maintain the accuracy and completeness of the personal information held by ANTALIS. To help us ensure we have the most up to date information about you, it is important that you inform us of any updates to your contact details or other personal information. Please contact the person you usually deal with at ANTALIS. You can also contact ANTALIS’ Global Data Protection Officer by sending a request to the following dedicated email dpo@antalis.com

9. RETENTION

ANTALIS will retain personal information only for as long as it is needed for the purposes described in section 4 above: The information we collect and how we use it. Note that retention periods may vary in different jurisdictions. Personal Data is usually kept for a minimum period of 2 years and might be kept for an extra-period defined by the applicable statute of limitation.

We may need to retain information for significant periods of time in order to establish, exercise or defend our legal rights, and for archiving and historical purposes. Where possible and practical, personal information will be rendered anonymous through the removal, substitution or blocking of details which enable individuals to be identified.

If you would like more information about the retention policy, please contact the Global Data Protection Officer by sending a request to the following dedicated email dpo@antalis.com .

10. YOUR RIGHTS

You have the following rights in relation to your personal information:
• to access the personal information held by ANTALIS about you;
• to have your personal information corrected, for example if it is incomplete or incorrect;
• to opt out of receiving marketing communications at any time;
• in certain circumstances and subject to applicable law, the right to restrict or object to the processing of your personal information, or request that your personal information is erased;
• in certain circumstances and subject to applicable law, the right to receive a copy of the personal information which you have provided to ANTALIS, in a structured, commonly used and machine-readable format (known as “data portability”);
• where you have provided personal information voluntarily, or otherwise consented to its use, the right to withdraw your consent;
• the right to complain to a Data Protection Authority (see further below).

If you wish to exercise your rights, please contact ANTALIS’ Global Data Protection Officer at by sending a request to the following dedicated email dpo@antalis.com

E-mailing and electronic communication for direct marketing purpose

When you create an account or register for the first time with us, ANTALIS will ask you if you wishes to receive marketing/commercial information from ANTALIS. In order to receive information from ANTALIS, You shall tick the box “I consent to receive marketing/commercial information or offer from or on behalf of ANTALIS Group by any electronic communication means in accordance with this Privacy Notice”. If you refuse to receive information, you shall leave the box unticked.

OPTIN: If you have agreed to receive information from ANTALIS, ANTALIS will be then allowed to send you digital or printed marketing/commercial information, such as product information, commercial offer, information about an event, information about a project, or an invitation, for example.

Or, if applicable:
DOUBLE OPTIN: If you have agreed to receive information, you will receive an email requesting you click on a link to fulfil a confirmation procedure of your consent to receive marketing/commercial information or offer from or on behalf of ANTALIS, any of ANTALIS companies and any of their official distributors by emails.

In order to unsubscribe, You can either go in your account section of the ANTALIS website and untick the box, or click on the unsubscribe link which will be included under any email sent by or on behalf of ANTALIS, or send an email to ANTALIS’ Global Data Protection Officer at by sending a request to the following dedicated email dpo@antalis.com

What if you are under 16?

If you are under the age of 16 or not of legal age in your country, please make sure you have permission from your parents / legal representative before providing us with personal data about you. Minors under 16 years old and otherwise persons not of legal age are not allowed to provide us with their personal data without such authorization.

Right to lodge a complaint

If our response does not satisfy you or if you believe that we are not processing your personal data in accordance with the law, you can lodge a complaint with the relevant data protection supervisory authority of your country.

Amendments to this declaration

This Privacy Notice has been updated in May 2018. We may make changes from time to time or modify it as necessary to comply with any applicable data protection law. You may wish to review it again on an ad hoc basis. Any changes to any provision of the Privacy Notice will apply from the date of publication on our websites.

Query

If you have a query about this Privacy Notice, please contact ANTALIS’ Global Data Protection Officer at by sending a request to the following dedicated email dpo@antalis.com